Unfortunately, working in IT you get the inside knowledge of how abysmal some users protect their credentials. An email comes in: “Oh no my password will expire!”, enters credentials without any consideration, 3 minutes later their emails are cloned and access to their companies system has been provided to the world.
The kicker? They don’t even report it until they notice something unusual like emails bouncing when they send out or no emails coming in, etc. Companies really need to push cybersecurity training on their staff and MFA enforcement above all else, there is no silver bullet for this sort of thing, but throw up enough roadblocks and access will come too difficult for the average script kiddy.
Can confirm - This was exactly my experience in both primary and high school. I fucked off out of school the moment I had a chance. It’s the death of creativity and child care and I weep for kids having to go through that shit today.